"If anything, DNSSEC would allow one to prove that the .ly TLD had published bogus DNS records." No it wouldn't. If you can force the registry to change name

"If anything, DNSSEC would allow one to prove that the .ly TLD had published bogus DNS records." No it wouldn't. If you can force the registry to change name servers records then they can change DS records as well and your new bogus name servers are nicely signed and legit. I think DNSSEC has potential but its a chicken and egg. So few places use it that its more of a risk than a benefit. The number one issue I see at the registries I manage happen when someone moves their shiny domain to a new provider who know nothing about DNSSEC, but the previous registrar had it signed. Instant foot gun which of course seems to be working for most places but not all because not that many recursive nameservers are set up to check for dnssec. Its really hard to diagnose if you've never used DNSSEC before.